~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/ipset/ip_set_hash_netportnet.c

Version: ~ [ linux-5.11 ] ~ [ linux-5.10.17 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.99 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.176 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.221 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.257 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.257 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  2  *
  3  * This program is free software; you can redistribute it and/or modify
  4  * it under the terms of the GNU General Public License version 2 as
  5  * published by the Free Software Foundation.
  6  */
  7 
  8 /* Kernel module implementing an IP set type: the hash:ip,port,net type */
  9 
 10 #include <linux/jhash.h>
 11 #include <linux/module.h>
 12 #include <linux/ip.h>
 13 #include <linux/skbuff.h>
 14 #include <linux/errno.h>
 15 #include <linux/random.h>
 16 #include <net/ip.h>
 17 #include <net/ipv6.h>
 18 #include <net/netlink.h>
 19 #include <net/tcp.h>
 20 
 21 #include <linux/netfilter.h>
 22 #include <linux/netfilter/ipset/pfxlen.h>
 23 #include <linux/netfilter/ipset/ip_set.h>
 24 #include <linux/netfilter/ipset/ip_set_getport.h>
 25 #include <linux/netfilter/ipset/ip_set_hash.h>
 26 
 27 #define IPSET_TYPE_REV_MIN      0
 28 #define IPSET_TYPE_REV_MAX      0 /* Comments support added */
 29 
 30 MODULE_LICENSE("GPL");
 31 MODULE_AUTHOR("Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>");
 32 IP_SET_MODULE_DESC("hash:net,port,net", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
 33 MODULE_ALIAS("ip_set_hash:net,port,net");
 34 
 35 /* Type specific function prefix */
 36 #define HTYPE           hash_netportnet
 37 #define IP_SET_HASH_WITH_PROTO
 38 #define IP_SET_HASH_WITH_NETS
 39 #define IPSET_NET_COUNT 2
 40 
 41 /* IPv4 variant */
 42 
 43 /* Member elements */
 44 struct hash_netportnet4_elem {
 45         union {
 46                 __be32 ip[2];
 47                 __be64 ipcmp;
 48         };
 49         __be16 port;
 50         union {
 51                 u8 cidr[2];
 52                 u16 ccmp;
 53         };
 54         u8 nomatch:1;
 55         u8 proto;
 56 };
 57 
 58 /* Common functions */
 59 
 60 static inline bool
 61 hash_netportnet4_data_equal(const struct hash_netportnet4_elem *ip1,
 62                            const struct hash_netportnet4_elem *ip2,
 63                            u32 *multi)
 64 {
 65         return ip1->ipcmp == ip2->ipcmp &&
 66                ip1->ccmp == ip2->ccmp &&
 67                ip1->port == ip2->port &&
 68                ip1->proto == ip2->proto;
 69 }
 70 
 71 static inline int
 72 hash_netportnet4_do_data_match(const struct hash_netportnet4_elem *elem)
 73 {
 74         return elem->nomatch ? -ENOTEMPTY : 1;
 75 }
 76 
 77 static inline void
 78 hash_netportnet4_data_set_flags(struct hash_netportnet4_elem *elem, u32 flags)
 79 {
 80         elem->nomatch = !!((flags >> 16) & IPSET_FLAG_NOMATCH);
 81 }
 82 
 83 static inline void
 84 hash_netportnet4_data_reset_flags(struct hash_netportnet4_elem *elem, u8 *flags)
 85 {
 86         swap(*flags, elem->nomatch);
 87 }
 88 
 89 static inline void
 90 hash_netportnet4_data_reset_elem(struct hash_netportnet4_elem *elem,
 91                                 struct hash_netportnet4_elem *orig)
 92 {
 93         elem->ip[1] = orig->ip[1];
 94 }
 95 
 96 static inline void
 97 hash_netportnet4_data_netmask(struct hash_netportnet4_elem *elem,
 98                               u8 cidr, bool inner)
 99 {
100         if (inner) {
101                 elem->ip[1] &= ip_set_netmask(cidr);
102                 elem->cidr[1] = cidr;
103         } else {
104                 elem->ip[0] &= ip_set_netmask(cidr);
105                 elem->cidr[0] = cidr;
106         }
107 }
108 
109 static bool
110 hash_netportnet4_data_list(struct sk_buff *skb,
111                           const struct hash_netportnet4_elem *data)
112 {
113         u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
114 
115         if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip[0]) ||
116             nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip[1]) ||
117             nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
118             nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
119             nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
120             nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
121             (flags &&
122              nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
123                 goto nla_put_failure;
124         return 0;
125 
126 nla_put_failure:
127         return 1;
128 }
129 
130 static inline void
131 hash_netportnet4_data_next(struct hash_netportnet4_elem *next,
132                           const struct hash_netportnet4_elem *d)
133 {
134         next->ipcmp = d->ipcmp;
135         next->port = d->port;
136 }
137 
138 #define MTYPE           hash_netportnet4
139 #define PF              4
140 #define HOST_MASK       32
141 #include "ip_set_hash_gen.h"
142 
143 static int
144 hash_netportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
145                      const struct xt_action_param *par,
146                      enum ipset_adt adt, struct ip_set_adt_opt *opt)
147 {
148         const struct hash_netportnet *h = set->data;
149         ipset_adtfn adtfn = set->variant->adt[adt];
150         struct hash_netportnet4_elem e = { };
151         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
152 
153         e.cidr[0] = IP_SET_INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
154         e.cidr[1] = IP_SET_INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
155         if (adt == IPSET_TEST)
156                 e.ccmp = (HOST_MASK << (sizeof(e.cidr[0]) * 8)) | HOST_MASK;
157 
158         if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
159                                  &e.port, &e.proto))
160                 return -EINVAL;
161 
162         ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0]);
163         ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip[1]);
164         e.ip[0] &= ip_set_netmask(e.cidr[0]);
165         e.ip[1] &= ip_set_netmask(e.cidr[1]);
166 
167         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
168 }
169 
170 static int
171 hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
172                      enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
173 {
174         const struct hash_netportnet *h = set->data;
175         ipset_adtfn adtfn = set->variant->adt[adt];
176         struct hash_netportnet4_elem e = { };
177         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
178         u32 ip = 0, ip_to = 0, ip_last, p = 0, port, port_to;
179         u32 ip2_from = 0, ip2_to = 0, ip2_last, ip2;
180         bool with_ports = false;
181         u8 cidr, cidr2;
182         int ret;
183 
184         e.cidr[0] = e.cidr[1] = HOST_MASK;
185         if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
186                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
187                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
188                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
189                      !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS) ||
190                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
191                      !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)))
192                 return -IPSET_ERR_PROTOCOL;
193 
194         if (tb[IPSET_ATTR_LINENO])
195                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
196 
197         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip) ||
198               ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2], &ip2_from) ||
199               ip_set_get_extensions(set, tb, &ext);
200         if (ret)
201                 return ret;
202 
203         if (tb[IPSET_ATTR_CIDR]) {
204                 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
205                 if (!cidr || cidr > HOST_MASK)
206                         return -IPSET_ERR_INVALID_CIDR;
207                 e.cidr[0] = cidr;
208         }
209 
210         if (tb[IPSET_ATTR_CIDR2]) {
211                 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
212                 if (!cidr || cidr > HOST_MASK)
213                         return -IPSET_ERR_INVALID_CIDR;
214                 e.cidr[1] = cidr;
215         }
216 
217         if (tb[IPSET_ATTR_PORT])
218                 e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
219         else
220                 return -IPSET_ERR_PROTOCOL;
221 
222         if (tb[IPSET_ATTR_PROTO]) {
223                 e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
224                 with_ports = ip_set_proto_with_ports(e.proto);
225 
226                 if (e.proto == 0)
227                         return -IPSET_ERR_INVALID_PROTO;
228         } else
229                 return -IPSET_ERR_MISSING_PROTO;
230 
231         if (!(with_ports || e.proto == IPPROTO_ICMP))
232                 e.port = 0;
233 
234         if (tb[IPSET_ATTR_CADT_FLAGS]) {
235                 u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
236                 if (cadt_flags & IPSET_FLAG_NOMATCH)
237                         flags |= (IPSET_FLAG_NOMATCH << 16);
238         }
239 
240         with_ports = with_ports && tb[IPSET_ATTR_PORT_TO];
241         if (adt == IPSET_TEST ||
242             !(tb[IPSET_ATTR_IP_TO] || with_ports || tb[IPSET_ATTR_IP2_TO])) {
243                 e.ip[0] = htonl(ip & ip_set_hostmask(e.cidr[0]));
244                 e.ip[1] = htonl(ip2_from & ip_set_hostmask(e.cidr[1]));
245                 ret = adtfn(set, &e, &ext, &ext, flags);
246                 return ip_set_enomatch(ret, flags, adt, set) ? -ret :
247                        ip_set_eexist(ret, flags) ? 0 : ret;
248         }
249 
250         ip_to = ip;
251         if (tb[IPSET_ATTR_IP_TO]) {
252                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
253                 if (ret)
254                         return ret;
255                 if (ip > ip_to)
256                         swap(ip, ip_to);
257                 if (unlikely(ip + UINT_MAX == ip_to))
258                         return -IPSET_ERR_HASH_RANGE;
259         }
260 
261         port_to = port = ntohs(e.port);
262         if (tb[IPSET_ATTR_PORT_TO]) {
263                 port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
264                 if (port > port_to)
265                         swap(port, port_to);
266         }
267 
268         ip2_to = ip2_from;
269         if (tb[IPSET_ATTR_IP2_TO]) {
270                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);
271                 if (ret)
272                         return ret;
273                 if (ip2_from > ip2_to)
274                         swap(ip2_from, ip2_to);
275                 if (unlikely(ip2_from + UINT_MAX == ip2_to))
276                         return -IPSET_ERR_HASH_RANGE;
277         }
278 
279         if (retried)
280                 ip = ntohl(h->next.ip[0]);
281 
282         while (!after(ip, ip_to)) {
283                 e.ip[0] = htonl(ip);
284                 ip_last = ip_set_range_to_cidr(ip, ip_to, &cidr);
285                 e.cidr[0] = cidr;
286                 p = retried && ip == ntohl(h->next.ip[0]) ? ntohs(h->next.port)
287                                                           : port;
288                 for (; p <= port_to; p++) {
289                         e.port = htons(p);
290                         ip2 = (retried && ip == ntohl(h->next.ip[0]) &&
291                                p == ntohs(h->next.port)) ? ntohl(h->next.ip[1])
292                                                          : ip2_from;
293                         while (!after(ip2, ip2_to)) {
294                                 e.ip[1] = htonl(ip2);
295                                 ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
296                                                                 &cidr2);
297                                 e.cidr[1] = cidr2;
298                                 ret = adtfn(set, &e, &ext, &ext, flags);
299                                 if (ret && !ip_set_eexist(ret, flags))
300                                         return ret;
301                                 else
302                                         ret = 0;
303                                 ip2 = ip2_last + 1;
304                         }
305                 }
306                 ip = ip_last + 1;
307         }
308         return ret;
309 }
310 
311 /* IPv6 variant */
312 
313 struct hash_netportnet6_elem {
314         union nf_inet_addr ip[2];
315         __be16 port;
316         union {
317                 u8 cidr[2];
318                 u16 ccmp;
319         };
320         u8 nomatch:1;
321         u8 proto;
322 };
323 
324 /* Common functions */
325 
326 static inline bool
327 hash_netportnet6_data_equal(const struct hash_netportnet6_elem *ip1,
328                            const struct hash_netportnet6_elem *ip2,
329                            u32 *multi)
330 {
331         return ipv6_addr_equal(&ip1->ip[0].in6, &ip2->ip[0].in6) &&
332                ipv6_addr_equal(&ip1->ip[1].in6, &ip2->ip[1].in6) &&
333                ip1->ccmp == ip2->ccmp &&
334                ip1->port == ip2->port &&
335                ip1->proto == ip2->proto;
336 }
337 
338 static inline int
339 hash_netportnet6_do_data_match(const struct hash_netportnet6_elem *elem)
340 {
341         return elem->nomatch ? -ENOTEMPTY : 1;
342 }
343 
344 static inline void
345 hash_netportnet6_data_set_flags(struct hash_netportnet6_elem *elem, u32 flags)
346 {
347         elem->nomatch = !!((flags >> 16) & IPSET_FLAG_NOMATCH);
348 }
349 
350 static inline void
351 hash_netportnet6_data_reset_flags(struct hash_netportnet6_elem *elem, u8 *flags)
352 {
353         swap(*flags, elem->nomatch);
354 }
355 
356 static inline void
357 hash_netportnet6_data_reset_elem(struct hash_netportnet6_elem *elem,
358                                 struct hash_netportnet6_elem *orig)
359 {
360         elem->ip[1] = orig->ip[1];
361 }
362 
363 static inline void
364 hash_netportnet6_data_netmask(struct hash_netportnet6_elem *elem,
365                               u8 cidr, bool inner)
366 {
367         if (inner) {
368                 ip6_netmask(&elem->ip[1], cidr);
369                 elem->cidr[1] = cidr;
370         } else {
371                 ip6_netmask(&elem->ip[0], cidr);
372                 elem->cidr[0] = cidr;
373         }
374 }
375 
376 static bool
377 hash_netportnet6_data_list(struct sk_buff *skb,
378                           const struct hash_netportnet6_elem *data)
379 {
380         u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
381 
382         if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip[0].in6) ||
383             nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip[1].in6) ||
384             nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
385             nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
386             nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
387             nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
388             (flags &&
389              nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
390                 goto nla_put_failure;
391         return 0;
392 
393 nla_put_failure:
394         return 1;
395 }
396 
397 static inline void
398 hash_netportnet6_data_next(struct hash_netportnet4_elem *next,
399                           const struct hash_netportnet6_elem *d)
400 {
401         next->port = d->port;
402 }
403 
404 #undef MTYPE
405 #undef PF
406 #undef HOST_MASK
407 
408 #define MTYPE           hash_netportnet6
409 #define PF              6
410 #define HOST_MASK       128
411 #define IP_SET_EMIT_CREATE
412 #include "ip_set_hash_gen.h"
413 
414 static int
415 hash_netportnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
416                      const struct xt_action_param *par,
417                      enum ipset_adt adt, struct ip_set_adt_opt *opt)
418 {
419         const struct hash_netportnet *h = set->data;
420         ipset_adtfn adtfn = set->variant->adt[adt];
421         struct hash_netportnet6_elem e = { };
422         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
423 
424         e.cidr[0] = IP_SET_INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
425         e.cidr[1] = IP_SET_INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
426         if (adt == IPSET_TEST)
427                 e.ccmp = (HOST_MASK << (sizeof(u8) * 8)) | HOST_MASK;
428 
429         if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
430                                  &e.port, &e.proto))
431                 return -EINVAL;
432 
433         ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0].in6);
434         ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip[1].in6);
435         ip6_netmask(&e.ip[0], e.cidr[0]);
436         ip6_netmask(&e.ip[1], e.cidr[1]);
437 
438         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
439 }
440 
441 static int
442 hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
443                      enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
444 {
445         const struct hash_netportnet *h = set->data;
446         ipset_adtfn adtfn = set->variant->adt[adt];
447         struct hash_netportnet6_elem e = { };
448         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
449         u32 port, port_to;
450         bool with_ports = false;
451         int ret;
452 
453         e.cidr[0] = e.cidr[1] = HOST_MASK;
454         if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
455                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
456                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
457                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
458                      !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS) ||
459                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
460                      !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)))
461                 return -IPSET_ERR_PROTOCOL;
462         if (unlikely(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_IP2_TO]))
463                 return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
464 
465         if (tb[IPSET_ATTR_LINENO])
466                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
467 
468         ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip[0]) ||
469               ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &e.ip[1]) ||
470               ip_set_get_extensions(set, tb, &ext);
471         if (ret)
472                 return ret;
473 
474         if (tb[IPSET_ATTR_CIDR])
475                 e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
476 
477         if (tb[IPSET_ATTR_CIDR2])
478                 e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
479 
480         if (unlikely(!e.cidr[0] || e.cidr[0] > HOST_MASK || !e.cidr[1] ||
481                      e.cidr[1] > HOST_MASK))
482                 return -IPSET_ERR_INVALID_CIDR;
483 
484         ip6_netmask(&e.ip[0], e.cidr[0]);
485         ip6_netmask(&e.ip[1], e.cidr[1]);
486 
487         if (tb[IPSET_ATTR_PORT])
488                 e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
489         else
490                 return -IPSET_ERR_PROTOCOL;
491 
492         if (tb[IPSET_ATTR_PROTO]) {
493                 e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
494                 with_ports = ip_set_proto_with_ports(e.proto);
495 
496                 if (e.proto == 0)
497                         return -IPSET_ERR_INVALID_PROTO;
498         } else
499                 return -IPSET_ERR_MISSING_PROTO;
500 
501         if (!(with_ports || e.proto == IPPROTO_ICMPV6))
502                 e.port = 0;
503 
504         if (tb[IPSET_ATTR_CADT_FLAGS]) {
505                 u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
506                 if (cadt_flags & IPSET_FLAG_NOMATCH)
507                         flags |= (IPSET_FLAG_NOMATCH << 16);
508         }
509 
510         if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
511                 ret = adtfn(set, &e, &ext, &ext, flags);
512                 return ip_set_enomatch(ret, flags, adt, set) ? -ret :
513                        ip_set_eexist(ret, flags) ? 0 : ret;
514         }
515 
516         port = ntohs(e.port);
517         port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
518         if (port > port_to)
519                 swap(port, port_to);
520 
521         if (retried)
522                 port = ntohs(h->next.port);
523         for (; port <= port_to; port++) {
524                 e.port = htons(port);
525                 ret = adtfn(set, &e, &ext, &ext, flags);
526 
527                 if (ret && !ip_set_eexist(ret, flags))
528                         return ret;
529                 else
530                         ret = 0;
531         }
532         return ret;
533 }
534 
535 static struct ip_set_type hash_netportnet_type __read_mostly = {
536         .name           = "hash:net,port,net",
537         .protocol       = IPSET_PROTOCOL,
538         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2 |
539                           IPSET_TYPE_NOMATCH,
540         .dimension      = IPSET_DIM_THREE,
541         .family         = NFPROTO_UNSPEC,
542         .revision_min   = IPSET_TYPE_REV_MIN,
543         .revision_max   = IPSET_TYPE_REV_MAX,
544         .create         = hash_netportnet_create,
545         .create_policy  = {
546                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
547                 [IPSET_ATTR_MAXELEM]    = { .type = NLA_U32 },
548                 [IPSET_ATTR_PROBES]     = { .type = NLA_U8 },
549                 [IPSET_ATTR_RESIZE]     = { .type = NLA_U8  },
550                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
551                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
552         },
553         .adt_policy     = {
554                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
555                 [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
556                 [IPSET_ATTR_IP2]        = { .type = NLA_NESTED },
557                 [IPSET_ATTR_IP2_TO]     = { .type = NLA_NESTED },
558                 [IPSET_ATTR_PORT]       = { .type = NLA_U16 },
559                 [IPSET_ATTR_PORT_TO]    = { .type = NLA_U16 },
560                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
561                 [IPSET_ATTR_CIDR2]      = { .type = NLA_U8 },
562                 [IPSET_ATTR_PROTO]      = { .type = NLA_U8 },
563                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
564                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
565                 [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
566                 [IPSET_ATTR_BYTES]      = { .type = NLA_U64 },
567                 [IPSET_ATTR_PACKETS]    = { .type = NLA_U64 },
568                 [IPSET_ATTR_COMMENT]    = { .type = NLA_NUL_STRING },
569         },
570         .me             = THIS_MODULE,
571 };
572 
573 static int __init
574 hash_netportnet_init(void)
575 {
576         return ip_set_type_register(&hash_netportnet_type);
577 }
578 
579 static void __exit
580 hash_netportnet_fini(void)
581 {
582         ip_set_type_unregister(&hash_netportnet_type);
583 }
584 
585 module_init(hash_netportnet_init);
586 module_exit(hash_netportnet_fini);
587 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp